Aggregator

Name: DEF CON CTF Qualifier 2026 (an DEF CON CTF Qualifier event.)
Date: May 22, 2026, 9 p.m. — 24 May 2026, 21:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://bbbirds.org/
Rating weight: 63.22
Event organizers: Benevolent Bureau of Birds

A vulnerability was found in Edimax BR-6478AC 1.23. It has been rated as critical. Affected by this issue is the function formiNICbasic of the file /goform/formiNICbasic of the component POST Request Handler. Performing a manipulation of the argument rootAPmac results in command injection. This vulnerability is identified as CVE-2026-9441. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability categorized as critical has been discovered in Edimax BR-6478AC 1.23. This affects the function formiNICSiteSurvey of the file /goform/formiNICSiteSurvey of the component POST Request Handler. Executing a manipulation of the argument selSSID can lead to buffer overflow. This vulnerability is tracked as CVE-2026-9442. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as critical has been detected in Edimax BR-6478AC 1.23. This vulnerability affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. The manipulation of the argument L2TPUserName leads to buffer overflow. This vulnerability is listed as CVE-2026-9443. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in rust-lang Cargo up to 1.95.x and classified as problematic. This affects an unknown part. Executing a manipulation can lead to use of non-canonical url paths for authorization decisions. This vulnerability appears as CVE-2026-5222. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in SourceCodester Simple POS and Inventory System 1.0. This issue affects the function delete of the file /admin/deleteproduct.php of the component GET Parameter Handler. The manipulation of the argument ID results in sql injection. This vulnerability is cataloged as CVE-2026-9444. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability marked as critical has been reported in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.php of the component File Extension Handler. This manipulation of the argument image causes unrestricted upload. This vulnerability is registered as CVE-2026-9445. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability has been found in rust-lang Cargo up to 1.95.x and classified as critical. Affected by this issue is some unknown functionality. Performing a manipulation results in symlink following. This vulnerability is reported as CVE-2026-5223. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

A vulnerability was found in CP Plus CP-E38Q, CP-E48Q, CP-E25Q, CP-E35Q, CP-E45Q, CP-E28Q, CP-E21Q, CP-E31Q, CP-E41Q, CP-E24Q, CP-Z43Q, CP-E34Q, CP-E44Q, CP-T31Q, CP-V48Q, CP-V41Q and CP-Z45Q. It has been classified as problematic. This vulnerability affects unknown code of the component UART Interface. The manipulation leads to cleartext storage of sensitive information. This vulnerability is traded as CVE-2026-9274. It is possible to launch the attack on the physical device. There is no exploit available.

A vulnerability described as critical has been identified in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the file /admin/edit_customer.php. Such manipulation of the argument ID leads to sql injection. This vulnerability is documented as CVE-2026-9446. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability, which was classified as problematic, was found in Apache Airflow Google Provider up to 21.x. Affected by this vulnerability is an unknown functionality of the component SSH Host-Key Verification. Such manipulation leads to key exchange without entity authentication. This vulnerability is documented as CVE-2026-45361. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

U.S. state governments are taking on a larger role in cybersecurity to help protect local communities and essential services. Many states are building state-led cyber defense programs, including cybersecurity clinics, regional security operations centers (RSOCs), and state cyber corps programs to reduce costs, strengthen the local workforce, and improve cyber resilience. Cyber defense programs in the U.S. as of April 2026 (Source: UC Berkley, CLTC) Some states are expanding shared services, centralized procurement, cyber risk … More →

The post US states step up cyber defenses to protect local communities appeared first on Help Net Security.

Ask a cybersecurity pro about Network Detection and Response (NDR) and you might still hear "Noisy," "Too much data." But ask the teams running NDR that includes agentic AI capabilities and you'll hear they're actually using it to catch threats earlier, triage faster, and chase fewer false positives. The old complaint lingers in part because reputations are sticky, and because NDR has evolved

Dutch authorities arrested two suspects after dismantling a bulletproof hosting network linked to cybercrime, disinfo, and Russian sanctions evasion.

Google Gemini – идеальный помощник редактора, сисадмина и, как выяснилось, мошенника.

关键词高危漏洞科技媒体 cyberkendra 发布博文，报道称 Windows 内核曝出严重漏洞，攻击者可穿

AI 漏洞挖掘开始交付"工程化结果" 从音频解码到工业 CAD，从车端 CAN 帧到企业 Java 中间件——这一次，AI 红队没有靠"灵感"。

AI 漏洞挖掘开始交付"工程化结果" 从音频解码到工业 CAD，从车端 CAN 帧到企业 Java 中间件——这一次，AI 红队没有靠"灵感"。

США срочно запускают производство памяти, которая будет работать 10 лет без замены.

A zero-click attack targeting iPhones on iOS 16 hijacked WhatsApp accounts without linked devices, warnings, or user interaction. There is a particular kind of security incident that is harder to explain than most: your WhatsApp account is sending messages you did not write, asking your contacts for money transfers, and when you check the “Linked […]